Decode JWT tokens online to view header, payload, and signature, check expiration, and verify claims — everything runs locally in your browser.
Decode and inspect JSON Web Tokens (JWT) online. View header parameters, payload claims, custom properties, and expiration dates securely inside your browser memory.
A JWT can be decoded without verifying its signature. You can optionally test HS256, RS256, or ES256 verification locally using your own test key.
Extracted RFC 7519 registered parameters, expiration status, and token age.
| Claim Name | JSON Key | Extracted Parameter & Date Details |
|---|---|---|
| Subject | sub | - |
| Issuer | iss | - |
| Audience | aud | - |
| Expiration Time | exp | - |
| Issued At | iat | - |
| Not Before | nbf | - |
| JWT ID | jti | - |
| Algorithm | alg (Header) | - |
| Token Type | typ (Header) | - |
Search and explore arbitrary payload properties, roles, and nested objects.
A JSON Web Token (JWT) defined in RFC 7519 is an open, industry-standard method for transmitting claims between two parties securely as a compact Base64URL string. Learn more using our <a href="/json-formatter" class="text-blue-400 underline hover:text-blue-300">JSON Formatter</a> to inspect structured JSON payloads.
Every JWT consists of three segments separated by dots: header.payload.signature. The header contains metadata (algorithm and token type), the payload contains identity claims and standard timestamps, and the signature section ensures data integrity. Decode raw Base64 data with our <a href="/base64-encoder-decoder" class="text-blue-400 underline hover:text-blue-300">Base64 Encoder/Decoder</a>.
Decoding a JWT converts Base64URL strings to human-readable UTF-8 JSON text. Anyone can decode a JWT. Signature verification checks whether the signature matches the header and payload using a secret or public key. A JWT can be decoded without verifying its signature.
Standard claims include "iss" (Issuer), "sub" (Subject), "aud" (Audience), "exp" (Expiration Time), "nbf" (Not Before), "iat" (Issued At), and "jti" (JWT ID). Inspecting these timestamps prevents accepting expired or premature authentication tokens.
Tokens without expiration claims or with long expiration windows expose APIs to replay attacks. Debug expired API sessions easily when troubleshooting <a href="/tools" class="text-blue-400 underline hover:text-blue-300">HTTP Status Code responses</a>.
All token decoding and local Web Crypto signature checks are performed entirely in your browser JavaScript memory. No tokens are sent over the network to any server or saved in local storage. Browse more tools in our <a href="/categories/developer-tools" class="text-blue-400 underline hover:text-blue-300">Developer Tools Workspace</a>.
Quick answers about how this tool works.
Plain-language explainers that sit next to this tool.
JWTs look like scrambled text but are just three base64url-encoded segments. Learn their structure, how to decode one safely, and why decoding is not the same as verifying.
Input tokens, output tokens, cached tokens and cache writes — what each one costs on GPT-6 Astra, what actually counts toward your input bill, and three worked examples showing where the money really goes.
Minification, uglification, and bundling get lumped together as "build steps," but each does something distinct. Here is exactly what each one changes in your code, with a before/after size example.
Auto-increment IDs leak your record count. Random UUIDs wreck index locality at scale. Here is a framework for choosing a primary key strategy based on how distributed your system actually is.
Search 244+ free tools by name, or pick a category below. Every one runs instantly in your browser — no signup, nothing to install.
Tap a star to rate us instantly.
